Forum Discussion

trungleon_11288's avatar
trungleon_11288
Icon for Nimbostratus rankNimbostratus
Mar 14, 2012

Unstable with Virtual Servers when running Active/Standby F5 Big-IP LTM 3600 ver 11.1

Hi all,

 

 

Our system have two F5 Big-IP LTM 3600 running under TMOS ver 11.1 with Active/Standby Mode. They have information as followings:

 

 

1. F5_01:

 

VLAN DMZ (Internal) Self IP: 10.5.255.252/16

 

VLAN DMZ (Internal) Floating IP: 10.5.255.254/16

 

VLAN LTM (External) Self IP: 10.6.255.252/16

 

VLAN LTM (External) Floating IP: 10.6.255.254/16

 

 

2. F5_02:

 

VLAN DMZ (Internal) Self IP: 10.5.255.253/16

 

VLAN DMZ (Internal) Floating IP: 10.5.255.254/16

 

VLAN LTM (External) Self IP: 10.6.255.253/16

 

VLAN LTM (External) Floating IP: 10.6.255.254/16

 

 

In additional, we have the the Virtual Servers: 10.6.1.10/16 attaches to the Pool that is included 06 web members port 8080 (10.5.1.61/16 -> 10.5.1.67/16). Of course, the Gateway for each web member is 10.5.255.254/16 (Floating IP for VLAN DMZ).

 

 

But now, when the Client access to the Virtual Servers: 10.6.1.10, it's very unstable (sometimes run and sometime can't).

 

 

The following process:

 

1. Accessable with 10.6.1.10 -> this mean can ping 10.6.1.10 from outside.

 

2. Inaccessable with 10.6.1.10 -> this mean can't ping 10.6.1.10 from outside.

 

 

So we need from your support to solve this issues.

 

 

Best Regards,

 

 

Trungleon

 

config
design

11 Replies

Sort By
  • trungleon_11288's avatar
    trungleon_11288
    Icon for Nimbostratus rankNimbostratus
    Mar 14, 2012
    I would like to update more imformation as follows:

     

     

    F5_01 has LTM+ASM license active module but F5_02 just has only LTM license active module. Is this reason lead to the unstable for the Virtual Server IP?

     

     

    Thanks so much.
  • koenning_107182's avatar
    koenning_107182
    Icon for Nimbostratus rankNimbostratus
    Mar 14, 2012
    Hi Trungleon,

     

     

    from the described situation, without further data, it is quite hard to diagnose.

     

    What is the default gw for the BIG-IP LTM ? Errors like this could happen if you not configure a default gw, and autolasthop then sends the traffic to the wrong mac of the upstream load shared l3 device. But that would be just one out of hundreds possible causes.

     

     

    How does your routing look like ?

     

     

    Cheers,

     

    Christian
  • trungleon_11288's avatar
    trungleon_11288
    Icon for Nimbostratus rankNimbostratus
    Mar 15, 2012
    Hi Koenning,

     

     

    The default GW for both F5 BigIP LTM 3600 is 10.6.1.1. The address in ASA inside interface (VLAN LTM).

     

     

    The upstream Layer 3 devices are Cisco ASA Firewall Failover Active/Standby. With ip inside interface (10.6.1.1 active and 10.6.1.2 standby).

     

     

    Mayble something wrong with MAC address of Virtual Servers: 10.6.1.10.

     

     

    Can i use the Floating IP_LTM: 10.6.255.254 instead of 10.6.1.10 for Virtual Servers?

     

     

    Thanks,

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Mar 15, 2012
    are you using asm? if so, have you checked /var/log/asm?

     

     

    have you ever failed over to unit02? did the issue still happen?

     

     

    Can i use the Floating IP_LTM: 10.6.255.254 instead of 10.6.1.10 for Virtual Servers?yes but i do not think it is relevant.

     

     

    sol10388: Support and precedence for self IP addresses used with virtual servers and NATs

     

    http://support.f5.com/kb/en-us/solutions/public/10000/300/sol10388.html
  • trungleon_11288's avatar
    trungleon_11288
    Icon for Nimbostratus rankNimbostratus
    Mar 15, 2012
    Hi nitass,

     

     

    Unit 01 is using LTM&ASM module (has license LTM&ASM)

     

    while Unit 02 is using LTM module (just has license for LTM)

     

     

    The Failover State very unstable, it's often disconnect and reconnect frequently so the role is also switchover (Active<->Standby) with each other frequently too. Therefore, the virtual servers: 10.6.1.10 can't access from outside at that time.

     

     

    This is the local traffic log from the Standby Unit:

     

    =====================================

     

    HA Connection with peer 10.5.255.253:1028 lost.

     

    HA Connection with peer 10.5.255.253:1028 lost.

     

    Connection to CMI peer 10.5.255.253 has been removed

     

    CMI reconnect timer: enabled

     

    Attempting to connect to CMI peer 10.5.255.253 port 6699

     

    CMI reconnect timer: disabled, all peers are connected

     

    HA Connection with peer 10.5.255.253:1028 established.

     

    HA Connection with peer 10.5.255.253:1028 established.

     

    ======================================

     

     

    The problem mayble related to the MAC Masquerade Address. Do you think so, Nitass?
  • Techgeeeg's avatar
    Techgeeeg
    Icon for Nimbostratus rankNimbostratus
    Mar 16, 2012
    Dear Trungleon,

     

    I will prefer you to do the following as first step kick out of the of boxes completely from the network and let all of the operations run from unit1 . If it goes fine kick out unit1 and bring in unti2 and checkthe same. If this process shows any disconnection or problem then you may have a problem in network as well.

     

    At first place what is the reason tha two boxes are licensed differently... and lets say even if they are licensed differently are both the modules LTM& ASM provisioned on Unit 1 or not if its only LTM module provisioned on both of the modules then it should work fine... If the boxes have different modules provisioned them make it same for both of the boxes. Are you not using serial cable for fail-over that only the network disruption is causing fail-over. If you are using only network fail-over and there is no serial cable avaliable then try to configure it on a separate port and see if it works fine.

     

    If you have done any Mac-address binding on the Firewall level remove it.

     

     

    Regards,
  • trungleon_11288's avatar
    trungleon_11288
    Icon for Nimbostratus rankNimbostratus
    Mar 18, 2012
    Hi Techgeeeg,

     

     

    I'm using the network & serial cable for the Failover link on both unit under ver TMOS 11.1. I have taken out one unit and all network cable related, then removed the HA configuration. At that time, only one unit is run with stand alone mode but the upstream link aggregation (L1.1, L1.2, L1.3, L1.4) to Switch was still unstable. They were been switchover up to down and reconnect frequently. Really, I didn't know what was going on with them, even though i have checked network cable, upstream devices carefully.

     

     

    Now, I have decided to boot the Unit to diiferent volume with TMOS 10.2.2 and everything is OK. I'm afraid of the operation with TMOS 11.1, maybe it can't stable operation with my device (BIG-IP LTM 3600).

     

     

    Thanks.
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Mar 18, 2012
    was unit falied over unexpectedly even using serial failover? from the log, i do not see failover state changing (e.g. active/standby). you know port 1028 is for mirroring data.

     

     

    by the way, when configuring network failover, have you had two unicast pairs (one is using mgmt interface and the other one is using tmm interface)?
  • trungleon_11288's avatar
    trungleon_11288
    Icon for Nimbostratus rankNimbostratus
    Mar 19, 2012
    Hi Nitass,

     

     

    Yes, the status is disconneted and reconnect even i have been using the network&serial cable. The worst case, it's failed. Of course, I rknow the port 1028 for mirroring data and 1026 for failover.

     

     

    For the network failover configuration, i also configured two unicast pair: one for the mgmt peer, and another for local adress of vlan Internal (DMZ).

     

     

    Rgds,
  • Techgeeeg's avatar
    Techgeeeg
    Icon for Nimbostratus rankNimbostratus
    Mar 21, 2012
    Hi Trungleon,

     

    When using multiple ports are trunk/etherchannel the duplex has to be fixed in case of cisco switch or else this type of behaviour shows up I am sure you are aware of it .... but with your comment that the setup is working fine with TMOS 10.2.2 this comment rules out. This problem needs to be addressed properly what exactly is giong on... TMOS 11.1 has problems I will agree to it. If you wish to continue with ver. 11.1 I prefer you better open a case with F5 Support.

     

     

    Regards,